It copies itself to the following locations: • %SYSDIR%\afido.exe • %drive%\afido.exe

It creates the following directory: • %TEMPDIR%\%random character string%.tmp

It deletes the following file: • %drive%\Autorun.inf

The following files are created:

– %TEMPDIR%\%random character string%\b2e.exe Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. – %TEMPDIR%\%random character string%\batfile.bat